Antonio Cangiano has an interesting set of Ruby benchmarks here: http://antoniocangiano.com/2008/12/09/the-great-ruby-shootout-december-2008/ The two results that were interesting to me were that JRuby does so well, and that REE ("Ruby Enterprise Edition") was a significant improvement over "plain old Ruby" too. I knew that the JRuby guys have done a lot of work, and done a nice job with their implementation, but didn't realize just how good it was. REE is a clever idea, but not that much code, and aimed at memory usage, not CPU, so it's interesting to see how much faster it ends up according to these tests. A few things that would be interesting to see:

• Raw startup time. Yeah, that probably penalizes JRuby, but it is still a scripting language, and using it like one isn't possible if it takes forever to start up. How much slower is it?
• A more detailed look at REE's times. How is it that it's that much faster because of some memory tweaks?

In any case, it's a nice bit of work by Antonio - grazie! Update - old, slow davidw missed the fact that there was a startup time benchmark included. Oops.

The Internet Watch Foundation has objected to the cover of a 1976 Scorpions album (which is, as far as I know, still legally on sale here, with that cover) and their collaborator ISPs have blocked access to Wikipedia. They claim that it covers 95% of British Residential ISPs but I could get through. Can you? Read more formal reports from AP via Google (claims 95% of users, which I think might be an error), BBC, Wikimedia Foundation News Release or The Guardian report (which chickens out of showing the whole cover image). Inspired by a short message from the owner of Cockspiracy, I’ve asked the Phone Coop election candidates for their views on it (note: I expect the question URL to change soon, so beware if you link to it), comparing it to our phorm promise. Did this affect you? Do you care? Have IWF just scuttled their ship?

Presentations with movies. I wanted to prepare a presentation with movie image. accentuate, a fork of keyjnote and impressive, the renamed version of keyjnote looked promising, but does not seem to work with video. Although very impressive, keyjnote development isn't too active. I don't like the design requiring the extra '.info' files for managing extra effects in PDF. latex-beamer could just dump special PDF commands into the PDF file and let keyjnote parse it?

If you’ve set up an online shop, are your product photos saying more about you than you intended?

“there’s a huge amount of potentially privacy-sensitive metadata in your typical JPEG as generated by your camera (including camera type, settings, date/time, maybe even GPS coordinates of your location, etc).” Source: jhead - List and modify EXIF fields in JPEG photos [Uwe Hermann's blog]

Even worse, if you’ve been using images from your suppliers or the manufacturers without permission, the metadata can be a dead giveaway. You really shouldn’t be using them without permission anyway, though. If you’re using your own photos, want to remove the camera data and you’re not comfortable using the command line, most graphics editors like GIMP allow you to edit or remove that extra information too (I think it’s on Save As… OK… Advanced Options and untick “Save EXIF data” in GIMP). It’s just a bit slower to convert lots of images with a GUI. (I’d usually do that sort of thing from the command line for TTLLP customers.) One fringe benefit is that removing the thumbnails and EXIF makes the images a bit smaller, so they’re quicker to download!

I’m working away from the office today because the office window is being replaced (an end to leaky draughty windows - yay! - but it does mean it’s about 3 degrees in there while it’s happening). For some reason, some things aren’t working over the wifi (the least of my network problems recently - blew up the router at the weekend), so I’m working in batches. I’ll let the phone go to voicemail and reply from a fixed line when I can. Pics and stuff about yesterday’s trade fair will appear later. I usually shy away from stuff labelled “geek” but here’s Bristol Wireless’s Christmas-time geek quiz night fundraiser on the 19th. D’ya reckon Woodsy will wear that bow-tie again when running the quiz?

“HIV/AIDS has been a global epidemic for more than 27 years. Most of today’s youth have never known a world without it. … The time is now. Together, we can prevent the spread of this pandemic through awareness, care, prevention, education and research.”

Today is World AIDS Day and I’m happy to support it as part of the Bloggers Unite effort.

Cooperatives-SW is working in partnership with the Regional Infrastructure for Social Enterprise (RISE) to hold a Trade Fair with support from CDA (BRAVE Ltd.), Social Enterprise Works, Co-opportunity and Watershed Media Centre. It will be held on Monday 1 December at the Watershed in Bristol. TTLLP will be there and I should post lots of news about it on Tuesday. I’ll try to microblog the event, but that depends how busy it is. Thanks to the VAT rate cut on the same day, I’ll be the only one there, leaving workers in the office just in case any of our customers have problems with their OSCommerce or Drupal online shops. (It seems there shouldn’t be any, but we hope for the best and prepare for the worst.) If you’d like to meet up on Monday, send me a comment however you prefer. Update: If you want to attend the event, registration details are on this page - it looks like registration is required, but I’ll be disappointed if they turn people away from the exhibition space between 1 and 2pm if there’s room.

I spent the second half of this morning delivering leaflets asking people to vote for the Weston Woods Path Project in today’s itv People’s Millions Big Lottery Fund competition. Just 50,000 gets a smooth, fairly flat, surfaced and edged path and takes some pedestrians off the bendy cliff-top road. Any surplus money from the call charges will be donated to charity. If you vote for it, you can comment on my blog to let me know if you want and you might like to watch WsM Forum for the reaction/news. It’s a beautiful day and North Somerset is a beautiful place but by hell is my jaw cold now! At least there’s no snow here.

It’ll be going out as a letter anyway, but broadband users who have usernames containing @phonecoop may like to read the announcement about changing uplink suppliers. There have been some other changes at The Phone Co-op which I’m asking about this evening. More on those later.

Since changes to Firefox made exporting bookmarks from Ice* a pain, I’m trying to find a social bookmarking site that is:-

1. run on free software
2. provides RSS feeds of new additions (pref. RSS-1, but any RSS is OK)
3. provides all my bookmarks for download/backup in some easy format (even an HTML page would be fine)
4. at least lets me view without javascript, so I can use my bookmarks from my smartphone easily

Is that so much to ask for? I’d probably add whatever is used the the blog hosting platform. So far, I’ve looked at:-

• delicious, furl, digg, stumbleupon, technorati, facebook - the blog host links these from every post but none of them look like free software and most make it hard to download bookmarks;
• Reddit - I’m not sure that CPAL is a free software license because of the Original Developer oddities;
• Magnolia - I thought it was free but I can’t find the licence now;
• Sitebar - close but javascript needed to view.

I’m wondering about downloading something like b. or insipid and parking it on software.coop somewhere. Am I missing an obvious candidate?

I live in one of a cluster of a dozen or so houses. As far as I can tell, none of them have any micro-generation capability (I think one has working solar panels and one has defunct panels), but we have an electricity substation and a small patch of land fenced off next to it. I’ve heard it said that the power distribution company would be open to selling the land. Surely we could do something here, with the stronger sun (compared to the most of the UK anyway) and the blustery winds? If only there was some model for grouping together for microgeneration… That’s what I understand as the idea behind the Carbon Co-op and I think it could make a difference. I’ve voted for it to be one of the ideas developed Friday 5th- Sunday 7th December 2008 at the Young Foundation, Bethnal Green, London (I may be in London one of those days). You can vote for it too, particularly if you’re interested in helping it happen too.

Thanks to Koha, TTLLP is partly a library services worker cooperative and just now there’s a massive flame-storm about the largest library services consumer cooperative - OCLC, the Online Computer Library Center - because it just updated the terms for sharing its book data collection. OCLC seems to be treating it as a private asset that it can exploit, not the common resource that many librarians thought it was. I’ve been watching this fire with interest - because, at best, I don’t think it’s helping other cooperatives that sell to libraries - and here is my summary. OCLC and the Great Library Scandal is a good introduction and there’s a summary of the Talis Podcast about OCLC WorldCat Record Use Policy with Karen Clahoun and Roy Tennant which reveals some of the OCLC thinking. Just like CC and Open Source? Still No is a great illustration of how some librarians think OCLC is reaching the wrong conclusion, which then leads to asking Is OCLC truly cooperative? and What would it look like if OCLC was broken up? A commenter on Tom Watson: Library data asks: “Why would libraries play this game?” Well, the road to hell is paved with good intentions and this road has taken 40 years. First off, OCLC is essentially a good idea - libraries cooperating to act as a counter-weight to the large library service companies. However, I believe OCLC predates many recent company rule innovations (stronger common asset locks) and data licensing innovations (Share-Alike, Fiduciary Licensing and the general free and open source software movements), so there’s nothing to stop them trying to privatise the assets (library data) that the libraries have given to OCLC and it was only a matter of time before someone tried. I’m having a similar discussion with another organisation that has been given data by its members under vague terms and is now apparently about to exploit that data for the organisation’s benefit, to the detriment of some members. TTLLP is a member but has not contributed much data because I was suspicious of the lack of terms. In time, hopefully, asset locks and more awareness of data licensing will eliminate these problems, but there’s going to be a lot more people getting burnt first. Finally, a quick shout-out to the Open Library Environment as a possible emerging alternative to OCLC for practical services. Raw Thought: Stealing Your Library: The OCLC Powergrab covers some of its motivation (and includes a link to a petition to OCLC, if you want something to sign), but I share Stefano’s (now there’s someone I’d not read in 7 or so years) analysis of some of the challenges:

“any grass-root approach that will get big enough to take on OCLC on the metadata collection and redistribution service that libraries need will have to incorporate under the pressure of its users (if only for legal liability protection) and will have to find an answer to the same set of problems (policy, governance, financial sustainability) that OCLC has.”

This week (21-28 November) is National Maintenance Week. Do a bit of maintenance on your home this week yourself and save a bit of money, as well as improving the appearance of your local community. National Gutters Day is next Friday (28th). After this summer’s heavy rains led to a curtain of rain falling down, I paid the window cleaners to clear our building’s gutters. Unfortunately, they didn’t clear quite close enough to the end of one gutter and it still overflowed - but I didn’t find this out until the next rainstorm. I’ve bought a long handle and a gutter-cleaning tool for about the price of one gutter-cleaning, so I can deal with it myself in future! How about you? The gutter-cleaning tool I’d really like are the long tongs, but I found three types in web searches and no-one sells any of them in Europe. Why not?

I’m sceptical about Global Enterpreneurship Week after last year’s problems, but today is Social Enterprise Day, so I’ve tried to get involved with the WalesCoop Ethical Entrepreneurs Online Discussion from 1-2pm and 7-8pm today. Come join us!

The next Software in the Public Interest board meeting will take at 2000 UTC (noon PST / 15:00 EST / 20:00 GMT / 21:00 CET) on Wednesday 19 November 2008 on irc.oftc.net #spi. The agenda is online, but I’ve not seen an announcement yet. I’m surprised there’s not much on the agenda. Missing topics include supporting FACIL. What else do you think SPI should be doing?

I just had a very nice chat on the phone with a man whose first attempt at online shopping seemed to have resulted in a fraudster using his card to buy mobile phone top-ups. I don’t understand why he called us (it wasn’t one of my web shops), but I hope I did the right thing by directing him back to his credit card company’s fraud department. While I was talking to him, I was checking the shop he had problems with. I wouldn’t have bought from it. Here’s how I checked it:- 1. Check the Page Open the front page of the site in one browser window and then use another window to get to a page that ought to be secure (the payment/checkout page is my usual one). Look at them both. Do either of them show any logos from well-known payment (Barclays, RBS, Protx, …) or security-checking services (thawte - who else?)? That’s not entirely reliable, but it’s usually a good sign because those companies attack people using their marks without permission. Look at the payment/checkout page - does the address in the address bar start “https”? If so, is the padlock in the browser status bar (usually bottom right) closed? That usually means it’s encrypted with a Secure Sockets Layer (SSL) certificate. 2. Check the Certificate Open the certificate details. In Firefox-based browsers, double-click the padlock, then click the “View Certificate” button. Then pick “Subject” in the second list box. Usually, it looks like this:-

in that case, as long as the “CN” (common name) is the webserver you thought you were using and the “O” (organisation) and country code (C) make sense, then there’s nothing wrong. Some shops now use Extended Validation certificates and give a bit more information. Here’s one from a train company:-

In addition to the CN and O, it shows Organisational Unit (OU), Location (L), State (ST) and also other address parts and company number that Firefox doesn’t display neatly. This is a bit more reassuring, but also a lot more expensive for the shop owner (around 20 times more, last I checked), so I don’t blame shops for not using them. 3. Check the Registrations By this point, the payment processing and actual transaction are looking pretty good. Finally, I check the recipient. Find the business details on the web shop. Does it include a geographic address? If it contains a company registration number, look it up on the Companies House website. Then I find the business details on the domain names - you can use CoolWhois to look up domain names. If any of the addresses or numbers don’t match (Website, SSL Certificate, Whois), then I call them to ask why their website says they’re based in Bristol but their domain name is registered to Bolton. If they don’t answer messages, or - worse - the domain name says “Non-trading Individual” and the address has been omitted from the public listing, I give up on them and look for another shop. There’s no point securely paying someone that you can never reach if there’s a problem. 4. Buy Stuff and Check the Statements All being well, I then buy stuff and check my credit card statement each month before I pay it. I think any web shop owner (or webmaster - I help some people with this sort of thing) should be taking care of the basics above. Do your shops measure up? Despite the above checks, I can only remember not buying something online once in the last year. A couple of times, I’ve worked through the above steps and it’s changed which shop I bought from - and I’m pretty sure it saved me from losing 400 on one purchase.

The mobile phone I travel with is pretty good and I use JabberMixClient to instant message from it. Version 2.1 finally got rid of the avatar-replacement bug, so I only wanted to solve my inability to make an SSL connection to our servers. (The linked email is slightly wrong: it’s signed by our own Certificate Authority, not self-signed.) The answer was to install TTLLP’s Certificate to the phone, as suggested on Sony Ericsson’s developer site. After a few unsuccessful atttempts, I corrected my two mistakes: firstly, I needed to install our CA certificate, not the server certificate; secondly, use PEM format, like on tjworld’s k800i. The exact command was obexftp -b $PHONE -p ca.pem and then the phone prompted me whether I wanted to install it. Now I can jabber from the phone without the phone company eavesdropping and without having to MidpSSH to a server. Can’t I?

Maybe, like me, you’ve noticed that you’ve had less junk email this week and you’ve been wondering why. News sites are reporting that a large spammer-friendly hosting service in California has been disconnected by its service providers after they were sent evidence about its activities. (Check out the “Next” links on the report to see how the story develops.) For the technically-minded, Changes in Spam Levels this week Posted by simonw illustrates the level of disruption and may grow an interesting discussion from server managers - it seems the reduction is less than the 75% reported in some news services, but still significant. This is great news for all good internet users. It’s disappointing if the spam hosting service won’t have to pay any of the costs they’ve inflicted on other computer users in some way. The only practical negative that I’ve noticed so far is that much of the stopped spam was pretty easy to identify and filter out, so the reduction in spam reaching my “unsure” mailbox hasn’t been anything like 50%. Still, less spam hitting the filters means less computer power used, which means less electricity and network data transfer used, which means lower costs for us. Yippee! And finally, I smiled at this comment over on the WebmasterWorld discussion:-

“Our spam email has dropped so much in the past 2 days that I was beginning to wonder if there was something wrong with our email accounts.”

Raphael cheers for the addition of an --as-needed option to a linker command line. While I think the general idea of not linking libraries you don't use directly is a good one, --as-needed is not a proper solution since it tells the linker to second-guess the compiler. A proper solution would be to fix the build systems so they don't pass the names of unneeded libraries in the first place. There are valid reasons for linking against objects that provide no symbols to the object being built, for example if the plugin ABI of a program has these symbols exported to plugins (in order to have all plugins agree on a common set of allocation functions).

I wrote to a site owner last week and I thought I was writing to a webmaster. The site owner complained about some of the jargon and, while explaining who I thought I was writing for, I explained some of it because I think more website owners might benefit from these three explanations:- “Expat-like terms” - made available in a way that is freely sharable, modifiable and redistributable, similar to the Expat software package, whose terms are published at http://www.jclark.com/xml/copying.txt - this is often used as a clear, simple example for encouraging wide distribution of electronic resources (software). “clandestine Google Analytics” - Google Analytics is a service from Google, Inc for tracking users through a website in various ways. I believe the Data Protection Act means that English websites should obtain informed consent from users by publishing a Privacy Policy on their site which discloses what the GA service will be used for and linking through to GA’s own Privacy Policy. Some websites attempt to run Google Analytics on users’ computers without explaining why and without any Privacy Policy. That is what I mean by “clandestine”. “valid xhtml” - validating against the eXtensible HyperText Markup Language standards published by the World Wide Web Consortium (W3C) - the underlying language of the web. There is a test service provided at http://validator.w3.org/ and passing it is a key stepping stone towards making an accessible website. There’s not really such a thing as “invalid xhtml” - if it doesn’t pass validation, it’s not xhtml. So I guess I’m guilty of using a tautology sometimes - sorry about that. Is it worthwhile knowing those three phrases? Are there other key technical phrases which you think site owners should know?